Pillarjs

Exploited now

None of this vendor's CVEs are on CISA's known-exploited list.

Recent

• 7.5HighMay 12, 2026Pillarjs multiparty Denial of serviceCVE-2026-8162multiparty@4.2.3 and lower versions are vulnerable to denial of service via uncaught exception. By sending a multipart/form-data request with a Content-Disposition header whose filename* parameter contains a malformed percent-encoding, the parser invokes decodeURI on the value without try/catch. The resulting URIError propagates as an uncaught exception and crashes the process. Impact: any service accepting multipart uploads via multiparty is affected. Workarounds: none. Upgrade to multiparty@4.
• 7.5HighMay 12, 2026Pillarjs multiparty Denial of serviceCVE-2026-8161multiparty@4.2.3 and lower versions are vulnerable to denial of service via uncaught exception. By sending a multipart/form-data request with a field name that collides with an inherited Object.prototype property such as __proto__, constructor, or toString, the parser invokes .push() on the inherited prototype value rather than an array, throwing a TypeError that propagates as an uncaught exception and crashes the process. Impact: any service accepting multipart uploads via multiparty is affecte
• 7.5HighMay 12, 2026Pillarjs multiparty Denial of serviceCVE-2026-8159multiparty@4.2.3 and lower versions are vulnerable to denial of service via regular expression backtracking in the Content-Disposition filename parameter parser. A crafted multipart upload with a long header value can cause regex matching to take seconds, blocking the event loop. Impact: any service accepting multipart uploads via multiparty is affected. Workarounds: limiting upload sizes at the proxy or gateway layer reduces but does not eliminate the attack surface, since a small header of aro
• 7.5HighMar 26, 2026Pillarjs path-to-regexp Denial of serviceCVE-2026-4926Impact: A bad regular expression is generated any time you have multiple sequential optional groups (curly brace syntax), such as `{a}{b}{c}:z`. The generated regex grows exponentially with the number of groups, causing denial of service. Patches: Fixed in version 8.4.0. Workarounds: Limit the number of sequential optional groups in route patterns. Avoid passing user-controlled input as route patterns.
• 5.9MediumMar 26, 2026Pillarjs path-to-regexp Denial of serviceCVE-2026-4923Impact: When using multiple wildcards, combined with at least one parameter, a regular expression can be generated that is vulnerable to ReDoS. This backtracking vulnerability requires the second wildcard to be somewhere other than the end of the path. Unsafe examples: /*foo-*bar-:baz /*a-:b-*c-:d /x/*a-:b/*c/y Safe examples: /*foo-:bar /*foo-:bar-*baz Patches: Upgrade to version 8.4.0. Workarounds: If you are using multiple wildcard parameters, you can check the regex output with a too
• 7.5HighMar 26, 2026Pillarjs path-to-regexp Denial of serviceCVE-2026-4867Impact: A bad regular expression is generated any time you have three or more parameters within a single segment, separated by something that is not a period (.). For example, /:a-:b-:c or /:a-:b-:c-:d. The backtrack protection added in path-to-regexp@0.1.12 only prevents ambiguity for two parameters. With three or more, the generated lookahead does not block single separator characters, so capture groups overlap and cause catastrophic backtracking. Patches: Upgrade to path-to-regexp@0.1.13
• 7.5HighSep 9, 2024Pillarjs path-to-regexp Denial of serviceCVE-2024-45296path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. Because JavaScript is single threaded and regex matching runs on the main thread, poor performance will block the event loo

See every Pillarjs entry on the dashboard.

Top products

• path-to-regexp3 CVEs in the last year
• multiparty3 CVEs in the last year

Advisories

Official advisories from the last 90 days that name this vendor's CVEs.

• Atlassian · Mar 18, 2025Atlassian Security Bulletin March 18, 2025CVE-2024-45296